Merge pull request #1457 from harfbuzz/cff-varstore-sanitize

[CFF] oss-fuzz issue 11713 (CFF2VariationStore::serialize)

Merge pull request #1457 from harfbuzz/cff-varstore-sanitize
[CFF] oss-fuzz issue 11713 (CFF2VariationStore::serialize)
f95324a3 · Ebrahim Byagowi · GitHub · 6727c4b6 · 9d8f3b0d · f95324a3
Showing with 1 addition and 1 deletion

src/hb-ot-cff2-table.hh src/hb-ot-cff2-table.hh +1 -1

test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5660711141769216 ...fuzz-testcase-minimized-hb-subset-fuzzer-5660711141769216 +0 -0

未找到文件。
--- a/src/hb-ot-cff2-table.hh
+++ b/src/hb-ot-cff2-table.hh
@@ -115,7 +115,7 @@ struct CFF2VariationStore
  inline bool sanitize (hb_sanitize_context_t *c) const
  {
    TRACE_SANITIZE (this);
-    return_trace (likely (c->check_struct (this)) && varStore.sanitize (c));
+    return_trace (likely (c->check_struct (this)) && c->check_range (&varStore, size) && varStore.sanitize (c));
  }
  inline bool serialize (hb_serialize_context_t *c, const CFF2VariationStore *varStore)

--- a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5660711141769216
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5660711141769216